efswrt.dll

Description: Storage Protection Windows Runtime DLL

Version: 10.0.19041.5848

Architecture: 64-bit

Operating System: Windows NT

SHA256: 6c0538086d6fb6ed2a8c70b566d434d8

File Size: 867.0 KB

Uploaded At: Dec. 1, 2025, 7:27 a.m.

Views: 11

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

CdplGetFileProtectionLevel (Ordinal: 1, Address: 0x18b90)
CdplIsAppAllowedToRun (Ordinal: 2, Address: 0x18fd0)
CdplIsAppDataProtectionSupported (Ordinal: 3, Address: 0xec40)
CdplIsSupported (Ordinal: 4, Address: 0x19940)
CdplProtectFileToLevel (Ordinal: 5, Address: 0x18a50)
CdplProtectFileToLevelWithResult (Ordinal: 6, Address: 0x188e0)
CdplProtectKnownUserFolders (Ordinal: 7, Address: 0x18be0)
CdplProtectSecretToLevel (Ordinal: 8, Address: 0x18ef0)
CdplUnprotectSecret (Ordinal: 9, Address: 0x18fb0)
DllCanUnloadNow (Ordinal: 10, Address: 0x5b90)
DllGetActivationFactory (Ordinal: 11, Address: 0x5c00)
DllGetClassObject (Ordinal: 12, Address: 0x5de0)
DpmBufferFree (Ordinal: 13, Address: 0xeb10)
DpmProtectSecretToIdentity (Ordinal: 14, Address: 0xe740)
DpmStreamClose (Ordinal: 15, Address: 0xeb00)
DpmStreamOpenToProtectToIdentity (Ordinal: 16, Address: 0xe920)
DpmStreamOpenToUnprotect (Ordinal: 17, Address: 0xea10)
DpmStreamUpdate (Ordinal: 18, Address: 0xeaf0)
DpmUnprotectSecret (Ordinal: 19, Address: 0xe8a0)
EnterpriseDataCopyProtection (Ordinal: 20, Address: 0xd0d0)
EnterpriseDataGetStatus (Ordinal: 21, Address: 0xd9a0)
EnterpriseDataProtect (Ordinal: 22, Address: 0xcae0)
EnterpriseDataRevoke (Ordinal: 23, Address: 0xd4a0)
FreeIdentityProtectorList (Ordinal: 24, Address: 0xe710)
GetEnterpriseActionForCopy (Ordinal: 25, Address: 0xdf40)
GetEnterpriseIdForNetworkPath (Ordinal: 26, Address: 0xdd10)
ProtectFileToEnterpriseIdentity (Ordinal: 27, Address: 0xeb20)
ProtectFileToIdentity (Ordinal: 28, Address: 0xcf50)
ProtectOrReprotectFileToIdentity (Ordinal: 29, Address: 0xeb70)
QueryIdentityProtectors (Ordinal: 30, Address: 0xe4e0)
UnprotectFile (Ordinal: 31, Address: 0xeb40)

Imported DLLs & Functions

api-ms-win-appmodel-runtime-internal-l1-1-3.dll

CouldMultiUserAppsBehaviorBePossibleForPackage (Address: 0x1800a0e60)

api-ms-win-appmodel-runtime-l1-1-0.dll

GetPackageFamilyName (Address: 0x1800a0e70)
GetPackageFullName (Address: 0x1800a0e78)
GetPackagesByPackageFamily (Address: 0x1800a0e88)
PackageFamilyNameFromFullName (Address: 0x1800a0e90)
PackageNameAndPublisherIdFromFamilyName (Address: 0x1800a0e80)

api-ms-win-appmodel-runtime-l1-1-1.dll

GetPackageFullNameFromToken (Address: 0x1800a0ea0)

api-ms-win-core-apiquery-l1-1-0.dll

ApiSetQueryApiSetPresence (Address: 0x1800a0eb0)

api-ms-win-core-com-l1-1-0.dll

CoCreateFreeThreadedMarshaler (Address: 0x1800a0f20)
CoCreateInstance (Address: 0x1800a0ed0)
CoDecrementMTAUsage (Address: 0x1800a0f10)
CoGetApartmentType (Address: 0x1800a0f18)
CoGetCallContext (Address: 0x1800a0ec0)
CoGetCallerTID (Address: 0x1800a0ee0)
CoGetInterfaceAndReleaseStream (Address: 0x1800a0ee8)
CoIncrementMTAUsage (Address: 0x1800a0f28)
CoMarshalInterface (Address: 0x1800a0f08)
CoMarshalInterThreadInterfaceInStream (Address: 0x1800a0ed8)
CoReleaseMarshalData (Address: 0x1800a0ec8)
CoTaskMemAlloc (Address: 0x1800a0f00)
CoTaskMemFree (Address: 0x1800a0ef0)
CoTaskMemRealloc (Address: 0x1800a0f38)
CoWaitForMultipleHandles (Address: 0x1800a0ef8)
CreateStreamOnHGlobal (Address: 0x1800a0f30)

api-ms-win-core-com-l1-1-1.dll

RoGetAgileReference (Address: 0x1800a0f48)

api-ms-win-core-com-midlproxystub-l1-1-0.dll

CStdStubBuffer2_Connect (Address: 0x1800a0fe8)
CStdStubBuffer2_CountRefs (Address: 0x1800a0f88)
CStdStubBuffer2_Disconnect (Address: 0x1800a0fa0)
CStdStubBuffer2_QueryInterface (Address: 0x1800a0f60)
NdrProxyForwardingFunction3 (Address: 0x1800a0fe0)
NdrProxyForwardingFunction4 (Address: 0x1800a0f80)
NdrProxyForwardingFunction5 (Address: 0x1800a0f90)
ObjectStublessClient10 (Address: 0x1800a0fd0)
ObjectStublessClient11 (Address: 0x1800a0f98)
ObjectStublessClient12 (Address: 0x1800a0fa8)
ObjectStublessClient13 (Address: 0x1800a1008)
ObjectStublessClient14 (Address: 0x1800a1000)
ObjectStublessClient15 (Address: 0x1800a0ff0)
ObjectStublessClient16 (Address: 0x1800a0fd8)
ObjectStublessClient17 (Address: 0x1800a0fc8)
ObjectStublessClient18 (Address: 0x1800a0f68)
ObjectStublessClient19 (Address: 0x1800a0f78)
ObjectStublessClient20 (Address: 0x1800a0f58)
ObjectStublessClient3 (Address: 0x1800a0f70)
ObjectStublessClient6 (Address: 0x1800a0fb0)
ObjectStublessClient7 (Address: 0x1800a0ff8)
ObjectStublessClient8 (Address: 0x1800a0fb8)
ObjectStublessClient9 (Address: 0x1800a0fc0)

api-ms-win-core-debug-l1-1-0.dll

DebugBreak (Address: 0x1800a1020)
IsDebuggerPresent (Address: 0x1800a1018)
OutputDebugStringW (Address: 0x1800a1028)

api-ms-win-core-delayload-l1-1-0.dll

DelayLoadFailureHook (Address: 0x1800a1038)

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI (Address: 0x1800a1048)

api-ms-win-core-errorhandling-l1-1-0.dll

GetLastError (Address: 0x1800a1068)
RaiseException (Address: 0x1800a1070)
SetLastError (Address: 0x1800a1058)
SetUnhandledExceptionFilter (Address: 0x1800a1060)
UnhandledExceptionFilter (Address: 0x1800a1078)

api-ms-win-core-file-l1-1-0.dll

CreateFileW (Address: 0x1800a10c8)
FindClose (Address: 0x1800a10b8)
FindFirstFileW (Address: 0x1800a10a0)
FindNextFileW (Address: 0x1800a10c0)
GetDriveTypeW (Address: 0x1800a1090)
GetFileAttributesW (Address: 0x1800a10b0)
GetFullPathNameW (Address: 0x1800a1088)
GetLongPathNameW (Address: 0x1800a1098)
GetVolumePathNameW (Address: 0x1800a10a8)

api-ms-win-core-file-l1-2-0.dll

GetTempPathW (Address: 0x1800a10d8)
GetVolumeNameForVolumeMountPointW (Address: 0x1800a10e0)

api-ms-win-core-file-l2-1-0.dll

GetFileInformationByHandleEx (Address: 0x1800a10f0)

api-ms-win-core-handle-l1-1-0.dll

CloseHandle (Address: 0x1800a1100)
DuplicateHandle (Address: 0x1800a1108)

api-ms-win-core-heap-l1-1-0.dll

GetProcessHeap (Address: 0x1800a1128)
HeapAlloc (Address: 0x1800a1118)
HeapFree (Address: 0x1800a1120)

api-ms-win-core-heap-l2-1-0.dll

LocalAlloc (Address: 0x1800a1140)
LocalFree (Address: 0x1800a1138)

api-ms-win-core-libraryloader-l1-2-0.dll

DisableThreadLibraryCalls (Address: 0x1800a1190)
FindStringOrdinal (Address: 0x1800a1150)
FreeLibrary (Address: 0x1800a1170)
GetModuleFileNameA (Address: 0x1800a1188)
GetModuleFileNameW (Address: 0x1800a1158)
GetModuleHandleExW (Address: 0x1800a1178)
GetModuleHandleW (Address: 0x1800a1160)
GetProcAddress (Address: 0x1800a1180)
LoadLibraryExW (Address: 0x1800a1168)
LoadStringW (Address: 0x1800a1198)

api-ms-win-core-localization-l1-2-0.dll

FormatMessageW (Address: 0x1800a11a8)
IdnToAscii (Address: 0x1800a11b0)

api-ms-win-core-marshal-l1-1-0.dll

HWND_UserFree (Address: 0x1800a11e8)
HWND_UserFree64 (Address: 0x1800a11f0)
HWND_UserMarshal (Address: 0x1800a11f8)
HWND_UserMarshal64 (Address: 0x1800a11e0)
HWND_UserSize (Address: 0x1800a11d0)
HWND_UserSize64 (Address: 0x1800a11c8)
HWND_UserUnmarshal (Address: 0x1800a11c0)
HWND_UserUnmarshal64 (Address: 0x1800a11d8)

api-ms-win-core-path-l1-1-0.dll

PathCchRemoveFileSpec (Address: 0x1800a1208)
PathCchSkipRoot (Address: 0x1800a1210)
PathIsUNCEx (Address: 0x1800a1218)

api-ms-win-core-processenvironment-l1-1-0.dll

ExpandEnvironmentStringsW (Address: 0x1800a1228)

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess (Address: 0x1800a1258)
GetCurrentProcessId (Address: 0x1800a1260)
GetCurrentThread (Address: 0x1800a1240)
GetCurrentThreadId (Address: 0x1800a1238)
GetProcessId (Address: 0x1800a1270)
OpenProcessToken (Address: 0x1800a1248)
OpenThreadToken (Address: 0x1800a1250)
TerminateProcess (Address: 0x1800a1268)

api-ms-win-core-processthreads-l1-1-1.dll

GetProcessMitigationPolicy (Address: 0x1800a1288)
OpenProcess (Address: 0x1800a1280)

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter (Address: 0x1800a12a0)
QueryPerformanceFrequency (Address: 0x1800a1298)

api-ms-win-core-psapi-l1-1-0.dll

QueryFullProcessImageNameW (Address: 0x1800a12b0)

api-ms-win-core-registry-l1-1-0.dll

RegCloseKey (Address: 0x1800a12c0)
RegCreateKeyExW (Address: 0x1800a12d0)
RegGetValueW (Address: 0x1800a12c8)
RegNotifyChangeKeyValue (Address: 0x1800a12d8)
RegOpenCurrentUser (Address: 0x1800a12f0)
RegOpenKeyExW (Address: 0x1800a12e0)
RegQueryValueExW (Address: 0x1800a12e8)

api-ms-win-core-rtlsupport-l1-1-0.dll

RtlCaptureContext (Address: 0x1800a1310)
RtlLookupFunctionEntry (Address: 0x1800a1308)
RtlVirtualUnwind (Address: 0x1800a1300)

api-ms-win-core-shlwapi-legacy-l1-1-0.dll

PathFindExtensionW (Address: 0x1800a1320)

api-ms-win-core-shlwapi-obsolete-l1-1-0.dll

StrStrIW (Address: 0x1800a1330)

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal (Address: 0x1800a1340)

api-ms-win-core-synch-l1-1-0.dll

AcquireSRWLockExclusive (Address: 0x1800a13c0)
AcquireSRWLockShared (Address: 0x1800a13d8)
CreateEventExW (Address: 0x1800a13e8)
CreateMutexExW (Address: 0x1800a1400)
CreateMutexW (Address: 0x1800a1350)
CreateSemaphoreExW (Address: 0x1800a1408)
DeleteCriticalSection (Address: 0x1800a13f8)
EnterCriticalSection (Address: 0x1800a1370)
InitializeCriticalSection (Address: 0x1800a1358)
InitializeCriticalSectionEx (Address: 0x1800a1388)
InitializeSRWLock (Address: 0x1800a1390)
LeaveCriticalSection (Address: 0x1800a13f0)
OpenSemaphoreW (Address: 0x1800a13a8)
ReleaseMutex (Address: 0x1800a1368)
ReleaseSemaphore (Address: 0x1800a13d0)
ReleaseSRWLockExclusive (Address: 0x1800a13a0)
ReleaseSRWLockShared (Address: 0x1800a13b0)
SetEvent (Address: 0x1800a13b8)
TryAcquireSRWLockExclusive (Address: 0x1800a13c8)
TryAcquireSRWLockShared (Address: 0x1800a1380)
TryEnterCriticalSection (Address: 0x1800a1398)
WaitForMultipleObjectsEx (Address: 0x1800a13e0)
WaitForSingleObject (Address: 0x1800a1378)
WaitForSingleObjectEx (Address: 0x1800a1360)

api-ms-win-core-synch-l1-2-0.dll

InitOnceBeginInitialize (Address: 0x1800a1440)
InitOnceComplete (Address: 0x1800a1420)
InitOnceExecuteOnce (Address: 0x1800a1428)
Sleep (Address: 0x1800a1430)
SleepConditionVariableSRW (Address: 0x1800a1450)
WaitOnAddress (Address: 0x1800a1448)
WakeAllConditionVariable (Address: 0x1800a1438)
WakeByAddressAll (Address: 0x1800a1418)

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime (Address: 0x1800a1468)
GetTickCount (Address: 0x1800a1460)

api-ms-win-core-threadpool-l1-2-0.dll

CloseThreadpoolTimer (Address: 0x1800a14d0)
CloseThreadpoolWait (Address: 0x1800a1490)
CloseThreadpoolWork (Address: 0x1800a14a0)
CreateThreadpoolTimer (Address: 0x1800a14a8)
CreateThreadpoolWait (Address: 0x1800a1480)
CreateThreadpoolWork (Address: 0x1800a14b0)
FreeLibraryWhenCallbackReturns (Address: 0x1800a1498)
SetThreadpoolTimer (Address: 0x1800a14c0)
SetThreadpoolWait (Address: 0x1800a1488)
SubmitThreadpoolWork (Address: 0x1800a1478)
WaitForThreadpoolTimerCallbacks (Address: 0x1800a14c8)
WaitForThreadpoolWaitCallbacks (Address: 0x1800a14b8)

api-ms-win-core-url-l1-1-0.dll

UrlGetPartW (Address: 0x1800a14e0)

api-ms-win-core-util-l1-1-0.dll

DecodePointer (Address: 0x1800a14f0)
EncodePointer (Address: 0x1800a14f8)

api-ms-win-core-winrt-error-l1-1-0.dll

GetRestrictedErrorInfo (Address: 0x1800a1528)
RoOriginateError (Address: 0x1800a1520)
RoOriginateErrorW (Address: 0x1800a1508)
RoTransformError (Address: 0x1800a1510)
SetRestrictedErrorInfo (Address: 0x1800a1518)

api-ms-win-core-winrt-error-l1-1-1.dll

IsErrorPropagationEnabled (Address: 0x1800a1540)
RoGetMatchingRestrictedErrorInfo (Address: 0x1800a1548)
RoReportFailedDelegate (Address: 0x1800a1538)

api-ms-win-core-winrt-l1-1-0.dll

RoGetActivationFactory (Address: 0x1800a1558)

api-ms-win-core-winrt-robuffer-l1-1-0.dll

RoGetBufferMarshaler (Address: 0x1800a1568)

api-ms-win-core-winrt-string-l1-1-0.dll

HSTRING_UserFree (Address: 0x1800a15c8)
HSTRING_UserFree64 (Address: 0x1800a15e8)
HSTRING_UserMarshal (Address: 0x1800a15f0)
HSTRING_UserMarshal64 (Address: 0x1800a15c0)
HSTRING_UserSize (Address: 0x1800a1578)
HSTRING_UserSize64 (Address: 0x1800a15d0)
HSTRING_UserUnmarshal (Address: 0x1800a15b8)
HSTRING_UserUnmarshal64 (Address: 0x1800a15b0)
WindowsCreateString (Address: 0x1800a15e0)
WindowsCreateStringReference (Address: 0x1800a1598)
WindowsDeleteString (Address: 0x1800a1588)
WindowsDuplicateString (Address: 0x1800a1580)
WindowsGetStringLen (Address: 0x1800a15d8)
WindowsGetStringRawBuffer (Address: 0x1800a1590)
WindowsIsStringEmpty (Address: 0x1800a15a0)
WindowsStringHasEmbeddedNull (Address: 0x1800a15a8)

api-ms-win-eventing-classicprovider-l1-1-0.dll

GetTraceEnableFlags (Address: 0x1800a1618)
GetTraceEnableLevel (Address: 0x1800a1608)
GetTraceLoggerHandle (Address: 0x1800a1628)
RegisterTraceGuidsW (Address: 0x1800a1610)
TraceMessage (Address: 0x1800a1620)
UnregisterTraceGuids (Address: 0x1800a1600)

api-ms-win-eventing-provider-l1-1-0.dll

EventActivityIdControl (Address: 0x1800a1658)
EventProviderEnabled (Address: 0x1800a1650)
EventRegister (Address: 0x1800a1640)
EventSetInformation (Address: 0x1800a1660)
EventUnregister (Address: 0x1800a1648)
EventWriteTransfer (Address: 0x1800a1638)

api-ms-win-security-base-l1-1-0.dll

CopySid (Address: 0x1800a1678)
EqualSid (Address: 0x1800a1690)
GetAce (Address: 0x1800a1688)
GetLengthSid (Address: 0x1800a1698)
GetSidSubAuthority (Address: 0x1800a16a0)
GetSidSubAuthorityCount (Address: 0x1800a16b0)
GetTokenInformation (Address: 0x1800a1680)
ImpersonateLoggedOnUser (Address: 0x1800a16a8)
RevertToSelf (Address: 0x1800a1670)

api-ms-win-security-sddl-l1-1-0.dll

ConvertSidToStringSidW (Address: 0x1800a16c8)
ConvertStringSidToSidW (Address: 0x1800a16c0)

api-ms-win-service-private-l1-1-0.dll

I_QueryTagInformation (Address: 0x1800a16d8)

combase.dll

(Address: 0x1800a16e8)
(Address: 0x1800a16f0)
(Address: 0x1800a16f8)

MPR.dll

WNetGetUniversalNameW (Address: 0x1800a0d80)

msvcrt.dll

__C_specific_handler (Address: 0x1800a1718)
__CxxFrameHandler3 (Address: 0x1800a17e8)
__dllonexit (Address: 0x1800a1728)
_amsg_exit (Address: 0x1800a1738)
_callnewh (Address: 0x1800a1780)
_CxxThrowException (Address: 0x1800a1760)
_initterm (Address: 0x1800a1720)
_lock (Address: 0x1800a1708)
_onexit (Address: 0x1800a1740)
_purecall (Address: 0x1800a17b0)
_ui64tow_s (Address: 0x1800a17a8)
_unlock (Address: 0x1800a1770)
_vsnprintf_s (Address: 0x1800a17d0)
_vsnwprintf (Address: 0x1800a1870)
_wcsicmp (Address: 0x1800a17c8)
_wcsnicmp (Address: 0x1800a1820)
_XcptFilter (Address: 0x1800a1798)
??_V@YAXPEAX@Z (Address: 0x1800a17f8)
??0exception@@QEAA@AEBQEBD@Z (Address: 0x1800a1778)
??0exception@@QEAA@AEBQEBDH@Z (Address: 0x1800a1878)
??0exception@@QEAA@AEBV0@@Z (Address: 0x1800a17e0)
??0exception@@QEAA@XZ (Address: 0x1800a17f0)
??1exception@@UEAA@XZ (Address: 0x1800a1858)
??1type_info@@UEAA@XZ (Address: 0x1800a17c0)
??3@YAXPEAX@Z (Address: 0x1800a1860)
?terminate@@YAXXZ (Address: 0x1800a1710)
?what@exception@@UEBAPEBDXZ (Address: 0x1800a1768)
free (Address: 0x1800a1730)
iswalpha (Address: 0x1800a1818)
malloc (Address: 0x1800a1788)
memcmp (Address: 0x1800a17d8)
memcpy (Address: 0x1800a1750)
memcpy_s (Address: 0x1800a1868)
memmove (Address: 0x1800a1748)
memmove_s (Address: 0x1800a1790)
memset (Address: 0x1800a1758)
qsort (Address: 0x1800a17b8)
realloc (Address: 0x1800a1800)
toupper (Address: 0x1800a1850)
wcschr (Address: 0x1800a1840)
wcscmp (Address: 0x1800a1880)
wcscpy_s (Address: 0x1800a1810)
wcsncmp (Address: 0x1800a1828)
wcsnlen (Address: 0x1800a1838)
wcsrchr (Address: 0x1800a17a0)
wcsstr (Address: 0x1800a1830)
wcstok_s (Address: 0x1800a1808)
wcstoul (Address: 0x1800a1848)

ntdll.dll

NtClose (Address: 0x1800a18a8)
NtDeviceIoControlFile (Address: 0x1800a18b0)
NtDuplicateObject (Address: 0x1800a18a0)
NtDuplicateToken (Address: 0x1800a18c0)
NtFsControlFile (Address: 0x1800a1918)
NtOpenFile (Address: 0x1800a1890)
NtOpenProcessToken (Address: 0x1800a18c8)
NtOpenThreadToken (Address: 0x1800a1898)
NtQuerySecurityAttributesToken (Address: 0x1800a18d8)
NtQuerySecurityObject (Address: 0x1800a1928)
NtQueryWnfStateData (Address: 0x1800a1990)
NtSetInformationThread (Address: 0x1800a18b8)
NtSetSecurityObject (Address: 0x1800a1958)
RtlAddAccessAllowedAce (Address: 0x1800a1940)
RtlAddAce (Address: 0x1800a1950)
RtlAllocateHeap (Address: 0x1800a18f0)
RtlCompareMemory (Address: 0x1800a18d0)
RtlCompareUnicodeString (Address: 0x1800a18f8)
RtlConvertSidToUnicodeString (Address: 0x1800a19a0)
RtlCopyUnicodeString (Address: 0x1800a18e8)
RtlCreateAcl (Address: 0x1800a1938)
RtlCreateSecurityDescriptor (Address: 0x1800a19d8)
RtlFreeHeap (Address: 0x1800a18e0)
RtlFreeUnicodeString (Address: 0x1800a19c8)
RtlGetAce (Address: 0x1800a1968)
RtlGetDaclSecurityDescriptor (Address: 0x1800a1920)
RtlInitUnicodeString (Address: 0x1800a1978)
RtlIsMultiSessionSku (Address: 0x1800a1910)
RtlLengthSid (Address: 0x1800a1948)
RtlNtStatusToDosError (Address: 0x1800a1908)
RtlPublishWnfStateData (Address: 0x1800a1980)
RtlQueryInformationAcl (Address: 0x1800a1960)
RtlQueryPackageClaims (Address: 0x1800a1900)
RtlSetDaclSecurityDescriptor (Address: 0x1800a1970)
RtlSubscribeWnfStateChangeNotification (Address: 0x1800a19d0)
RtlUnsubscribeWnfNotificationWaitForCompletion (Address: 0x1800a1988)
ZwClose (Address: 0x1800a19b0)
ZwOpenProcessTokenEx (Address: 0x1800a19b8)
ZwOpenThreadTokenEx (Address: 0x1800a19a8)
ZwQueryInformationProcess (Address: 0x1800a19c0)
ZwQueryInformationToken (Address: 0x1800a1998)
ZwQueryWnfStateData (Address: 0x1800a1930)

OLEAUT32.dll

SysFreeString (Address: 0x1800a0d90)

RPCRT4.dll

CStdStubBuffer_AddRef (Address: 0x1800a0db0)
CStdStubBuffer_Connect (Address: 0x1800a0e38)
CStdStubBuffer_CountRefs (Address: 0x1800a0de0)
CStdStubBuffer_DebugServerQueryInterface (Address: 0x1800a0da8)
CStdStubBuffer_DebugServerRelease (Address: 0x1800a0e20)
CStdStubBuffer_Disconnect (Address: 0x1800a0e50)
CStdStubBuffer_Invoke (Address: 0x1800a0df0)
CStdStubBuffer_IsIIDSupported (Address: 0x1800a0e00)
CStdStubBuffer_QueryInterface (Address: 0x1800a0e08)
I_RpcBindingInqLocalClientPID (Address: 0x1800a0dd8)
IUnknown_AddRef_Proxy (Address: 0x1800a0dd0)
IUnknown_QueryInterface_Proxy (Address: 0x1800a0e28)
IUnknown_Release_Proxy (Address: 0x1800a0dc8)
NdrCStdStubBuffer_Release (Address: 0x1800a0e30)
NdrCStdStubBuffer2_Release (Address: 0x1800a0e40)
NdrDllCanUnloadNow (Address: 0x1800a0da0)
NdrDllGetClassObject (Address: 0x1800a0e18)
NdrOleAllocate (Address: 0x1800a0e10)
NdrOleFree (Address: 0x1800a0e48)
NdrStubCall3 (Address: 0x1800a0df8)
NdrStubForwardingFunction (Address: 0x1800a0de8)
UuidCreateNil (Address: 0x1800a0db8)
UuidFromStringW (Address: 0x1800a0dc0)